2026-05-14 归档

今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。

漏洞预警2026-05-14 发布MEDIUM

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-middle attacker may ac...

CVE-2026-41281

CVE-2026-41281 影响 KDDI CORPORATION 提供的 Android 应用“あんしんフィルター for au”。该应用存在明文传输敏感信息漏洞（CWE-319），攻击者可以通过中间人攻击（MITM）截获并篡改客户端与

历史摘要 · 未重新核验 · NVD

#cve #cwe-319

漏洞预警2026-05-13 发布HIGH

gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-...

CVE-2026-44471

gitoxide 是一个用 Rust 实现的 Git 工具。在版本 0.21.1 之前，存在一个安全漏洞，允许攻击者构造恶意的树对象（tree），当使用 gitoxide 检出（checkout）该树时，会在用户有写入权限的任何现有目录中写

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-05-13 发布HIGH

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which w...

CVE-2026-44447

ERPNext 是一个免费开源的企业资源规划工具。在 16.9.0 版本之前，部分端点存在 SQL 注入漏洞。攻击者可以通过特制的请求利用该漏洞，从而提取敏感信息。CVSS 评分为 8.8（高危），攻击向量为网络远程攻击，攻击复杂度低，需要

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布HIGH

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted req...

CVE-2026-44446

ERPNext是一个免费开源的企业资源规划（ERP）工具。在版本15.104.3和16.14.0之前，某些端点存在SQL注入漏洞，攻击者可通过特制请求利用此漏洞。该漏洞无需交互即可远程利用，但需要低权限（PR:L）。成功利用后，攻击者能够提

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布HIGH

PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiat...

CVE-2026-44439

PlaywrightCapture 是一个基于 Playwright 的 Splash 替代工具，用于捕获网页截图或内容。在版本 1.39.6 之前，PlaywrightCapture 未充分限制渲染页面发起的导航和资源请求。攻击者可以通过

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-13 发布INFO

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the...

CVE-2026-44437

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25,

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-601

漏洞预警2026-05-13 发布INFO

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a ...

CVE-2026-44369

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-05-13 发布INFO

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and...

CVE-2026-42463

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-13 发布INFO

Rejected reason: This CVE is a duplicate of another CVE.

CVE-2026-40328

Rejected reason: This CVE is a duplicate of another CVE.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

Rejected reason: This CVE is a duplicate of another CVE.

CVE-2026-40327

Rejected reason: This CVE is a duplicate of another CVE.

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-13 发布INFO

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

CVE-2026-32993

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated a

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-05-13 发布INFO

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

CVE-2026-32992

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-05-13 发布INFO

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

CVE-2026-29205

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdav

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-05-13 发布INFO

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual...

CVE-2026-8328

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to rep

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-13 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clic...

CVE-2026-45708

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into t

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-13 发布INFO

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by post...

CVE-2026-45229

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-05-13 发布INFO

Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-...

CVE-2026-45228

Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-13 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The...

CVE-2026-45055

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-345 #cwe-601 #cwe-784

漏洞预警2026-05-13 发布INFO

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parame...

CVE-2026-44418

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in...

CVE-2026-44381

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed

历史摘要 · 未重新核验 · NVD

#cve #cwe-89